base/bif/plugins/Zeek_WebSocket.events.bif.zeek

GLOBAL
Namespace

GLOBAL

Summary

Events

websocket_close: event

Generated for WebSocket Close frames.

websocket_established: event

Generated when a WebSocket handshake completed.

websocket_frame: event

Generated for every WebSocket frame.

websocket_frame_data: event

Generated for every chunk of WebSocket frame payload data.

websocket_message: event

Generated for every completed WebSocket message.

Detailed Interface

Events

websocket_close
Type

event (c: connection, is_orig: bool, status: count, reason: string)

Generated for WebSocket Close frames.

Parameters
  • c – The WebSocket connection.

  • is_orig – True if the frame is from the originator, else false.

  • status – If the CloseFrame had no payload, this is 0, otherwise the value of the first two bytes in the frame’s payload.

  • reason – Remaining payload after status. This is capped at 2 bytes less than WebSocket::payload_chunk_size.

See also: WebSocket::payload_chunk_size

websocket_established
Type

event (c: connection, aid: count)

Generated when a WebSocket handshake completed.

Parameters
  • c – The WebSocket connection.

  • aid – The analyzer identifier of the WebSocket analyzer.

See also: WebSocket::__configure_analyzer, WebSocket::configure_analyzer

websocket_frame
Type

event (c: connection, is_orig: bool, fin: bool, rsv: count, opcode: count, payload_len: count)

Generated for every WebSocket frame.

Parameters
  • c – The WebSocket connection.

  • is_orig – True if the frame is from the originator, else false.

  • fin – True if the fin bit is set, else false.

  • rsv – The value of the RSV1, RSV2 and RSV3 bits.

  • opcode – The frame’s opcode.

  • payload_len – The frame’s payload length.

websocket_frame_data
Type

event (c: connection, is_orig: bool, data: string)

Generated for every chunk of WebSocket frame payload data.

Do not use it to extract data from a WebSocket connection unless for testing or experimentation. Consider implementing a proper analyzer instead.

Parameters
  • c – The WebSocket connection.

  • is_orig – True if the frame is from the originator, else false.

  • data – One data chunk of frame payload. The length of is at most WebSocket::payload_chunk_size bytes. A frame with a longer payload will result in multiple events events.

See also: WebSocket::payload_chunk_size

websocket_message
Type

event (c: connection, is_orig: bool, opcode: count)

Generated for every completed WebSocket message.

Parameters
  • c – The WebSocket connection.

  • is_orig – True if the frame is from the originator, else false.

  • opcode – The first frame’s opcode.